Individuals with responsibility for securing information often deploy measures that are solution-centric, such as firewalls, encryption software and password tokens, without fully understanding how these measures affect the overall security posture of their organization. The lack of documented security standards and regulations addressing information security issues has created an environment in which security solutions and architecture are driven by “industry-best standards” and may even consist of ad-hoc patches to solve specific security problems.
Individuals with responsibility for securing information often deploy measures that are solution-centric, such as firewalls, encryption software, and password tokens, without fully understanding how these measures affect the overall security posture of their organization. The lack of documented security standards and regulations addressing information security issues has created an environment where security solutions or computer system architecture are driven by “industry-best standards.” In some instances the solutions may even be ad-hoc patches designed to solve individual or specific security problems.
Recently, a number of initiatives have been proposed to address the lack of standards for information assurance (IA). These regulatory initiatives include the Gramm-Leach-Bliley (GLB) Act and the Health Insurance Portability and Accountability Act (HIPAA) which set forth requirements for protecting personal financial and medical information. In addition, standards for corporate security are constantly being rewritten, resulting in private organizations having no operational requirements with which to implement robust security practices. Moreover, the fact that a corporation's information assets and critical business functions are increasingly reliant upon an electronic infrastructure, means that every organization must answer to regulators, stockholders, customers and partners when formulating and implementing an Information Assurance and Security Strategy and Program to safeguard such assets and functions.
To accommodate both internal and external standards and security requirements, as well as applicable laws, organizations must go through a process of translating their business needs in regard to addressing the IA standards, into a security policy statement detailing how that company will meet and comply with those standards. Then that same company must implement a security program that actually complies with its security policies. Moreover, the company must routinely monitor and validate that its implemented security program is effective and continues to comply with the goals of its security policy as the requirements for IA change, and its computer network information infrastructure evolve.
There are various ways a corporation can attempt to assess its compliance with regulatory standards and/or security policies. For example, a consultant can question a corporation's information officer to determine what measures that corporation has in place to safeguard its electronic information assets. Or the corporation can employ automated tools to perform certain aspects of the assessment. Some commercially available automated tools include CyberCop Scanner, the Security Administrator Tool for Analyzing Networks (SATAN Suite), and Internet Security Systems' ISS Scanner. Although these automated products can scan computer infrastructures for vulnerabilities by actively probing particular aspects of the user's computer network, these public domain applications do not provide an analysis that is related to specific regulatory standards or specific security policies or requirements. Moreover, the existing automated tools lack an analytical mechanism to manage the results of such computer infrastructure scans. Another shortcoming of commercial, as well as open-source scanners, is that the reporting capabilities of these products are immature and require highly technical personnel to analyze and make sense out of the results.
Therefore, it would be advantageous if a system and method existed which provided for the automated prompting for and collection of policy and administrative information via an automated questionnaire. It would also be advantageous if the questionnaire was created specifically for the type of regulation or security policy employed by the user. It would also be advantageous if the questionnaire could be stored in a database and used with similarly situated users. It would also be advantageous if a system and method existed which contained an analytical mechanism that devised assessments of a user's computer network based on that input data. As a corollary to the Policy Questionnaire, it would also be advantageous if a system and method existed which performed a supplemental assessment by remotely scanning the user's network, thereby generating data which not only validates the Questionnaire input, but also provides additional assessment of the user's network in terms of vulnerabilities, or in terms of compliance with certain regulatory standards and security policies or operating criteria. It would also be advantageous if the generated data could be presented to the user in various formats.